Put Grafana behind Nginx with HTTPS

Start from the grafana-installed snapshot of graf01. Every command runs on graf01 unless a step says “on your laptop”. You end with Grafana on https://graf01.lab/ and port 3000 closed to the network.

1Map graf01.lab on your laptop

Your laptop needs to know that graf01.lab means 192.168.56.70. Edit the hosts file as administrator: /etc/hosts on Linux and macOS, C:\Windows\System32\drivers\etc\hosts on Windows (open Notepad with “Run as administrator”).

Add this line on your laptop:

192.168.56.70 graf01.lab

Then run this on your laptop:

ping -c 2 graf01.lab

On a Linux laptop you should see (your times will differ):

PING graf01.lab (192.168.56.70) 56(84) bytes of data.
64 bytes from graf01.lab (192.168.56.70): icmp_seq=1 ttl=64 time=0.402 ms
64 bytes from graf01.lab (192.168.56.70): icmp_seq=2 ttl=64 time=0.388 ms

On Windows use ping -n 2 graf01.lab; Windows and macOS word the lines a little differently, but the reply must come from 192.168.56.70. The VMs already know the name from Lesson 1, because their /etc/hosts has the graf01.lab line.

✅ Checkpoint: ping graf01.lab from your laptop answers from 192.168.56.70.

2Install Nginx and open the firewall

Run this on graf01:

sudo apt-get install -y nginx
sudo ufw allow OpenSSH
sudo ufw allow from 192.168.56.0/24 to any port 443 proto tcp
sudo ufw allow from 192.168.56.0/24 to any port 80 proto tcp
sudo ufw --force enable
sudo ufw status numbered

You should see:

Status: active

     To                         Action      From
     --                         ------      ----
[ 1] OpenSSH                    ALLOW IN    Anywhere
[ 2] 443/tcp                    ALLOW IN    192.168.56.0/24
[ 3] 80/tcp                     ALLOW IN    192.168.56.0/24
[ 4] OpenSSH (v6)               ALLOW IN    Anywhere (v6)

Allow SSH before enabling ufw, or you lock yourself out of your own session. Port 3000 isn’t in the list, so from now on the firewall drops it; port 80 stays open only to redirect people to HTTPS.

✅ Checkpoint: ufw is active with OpenSSH, 443 and 80 allowed, and nothing for 3000.

3Create a self-signed certificate with SAN

Paste this whole block on graf01:

sudo mkdir -p /etc/ssl/graf01
sudo openssl req -x509 -nodes -newkey rsa:2048 -days 825 \
  -keyout /etc/ssl/graf01/graf01.key -out /etc/ssl/graf01/graf01.crt \
  -subj "/CN=graf01.lab" \
  -addext "subjectAltName=DNS:graf01.lab,IP:192.168.56.70"
sudo chmod 600 /etc/ssl/graf01/graf01.key
openssl x509 -in /etc/ssl/graf01/graf01.crt -noout -subject -ext subjectAltName -enddate

You should see (the dots, plus signs and date will differ):

.....+...+++++++++++++++++++++++++++++++++
-----
subject=CN=graf01.lab
X509v3 Subject Alternative Name:
    DNS:graf01.lab, IP Address:192.168.56.70
notAfter=Feb 10 06:14:58 2029 GMT

The dots and plus signs are OpenSSL generating the key. That’s OpenSSL 3.5 on Ubuntu 26.04; the OpenSSL 3.0 on 24.04 prints the subject with spaces, as subject=CN = graf01.lab. The -addext option puts the SAN straight into the certificate, and including the IP lets https://192.168.56.70/ pass the name check too. 825 days is the longest lifetime Apple devices accept for a certificate like this.

✅ Checkpoint: openssl x509 shows DNS:graf01.lab and IP Address:192.168.56.70 in the SAN.

4Write the Nginx site for Grafana

Paste this whole block on graf01:

sudo tee /etc/nginx/sites-available/grafana >/dev/null <<'EOF'
# Needed for Grafana Live (WebSocket)
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

upstream grafana {
    server 127.0.0.1:3000;
}

server {
    listen 80;
    server_name graf01.lab 192.168.56.70;
    return 301 https://graf01.lab$request_uri;
}

server {
    listen 443 ssl;
    server_name graf01.lab 192.168.56.70;

    ssl_certificate     /etc/ssl/graf01/graf01.crt;
    ssl_certificate_key /etc/ssl/graf01/graf01.key;
    ssl_protocols       TLSv1.2 TLSv1.3;

    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://grafana;
    }

    location /api/live/ {
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
        proxy_set_header Host $host;
        proxy_pass http://grafana;
    }
}
EOF
sudo ln -sf /etc/nginx/sites-available/grafana /etc/nginx/sites-enabled/grafana
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t && sudo systemctl reload nginx

You should see:

nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful

The map sets $connection_upgrade to “upgrade” when the browser asks for a WebSocket and to “close” otherwise. proxy_pass http://grafana has no trailing path, so Nginx passes the URI unchanged, which is what Grafana expects at the root of a host name. Ubuntu 26.04’s newer Nginx also accepts http2 on; inside the server block, but 24.04’s Nginx 1.24 doesn’t, so it’s left out to keep one config for both.

✅ Checkpoint: nginx -t says syntax is ok and test is successful, and nginx reloaded.

5Tell Grafana about the proxy

Edit /etc/grafana/grafana.ini and set these lines in the [server] section (uncomment them and keep domain = graf01.lab from Lesson 2):

[server]
protocol = http
http_addr = 127.0.0.1
http_port = 3000
domain = graf01.lab
root_url = https://graf01.lab/
serve_from_sub_path = false

Then run this:

sudo systemctl restart grafana-server
sudo ss -ltnp | grep -E ':(3000|443|80) '

You should see (your PIDs will differ):

LISTEN 0      511          0.0.0.0:443        0.0.0.0:*    users:(("nginx",pid=4120,fd=7),("nginx",pid=4119,fd=7))
LISTEN 0      511          0.0.0.0:80         0.0.0.0:*    users:(("nginx",pid=4120,fd=6),("nginx",pid=4119,fd=6))
LISTEN 0      4096       127.0.0.1:3000       0.0.0.0:*    users:(("grafana",pid=4188,fd=11))

protocol stays http because Nginx handles TLS, and Grafana only talks plain HTTP on loopback. Grafana now listens on 127.0.0.1:3000 instead of *:3000, so even with ufw off nobody outside graf01 could reach it directly.

✅ Checkpoint: ss shows nginx on 0.0.0.0:443 and :80, and grafana only on 127.0.0.1:3000.

6Test from graf01 with curl

Run this on graf01:

curl -s --cacert /etc/ssl/graf01/graf01.crt https://graf01.lab/api/health; echo
curl -sI http://graf01.lab/dashboards | grep -iE '^(HTTP|location)'
curl -sI https://graf01.lab/ -k | grep -iE '^(HTTP|location|server)'

You should see:

{
  "database": "ok",
  "version": "13.3.0",
  "commit": "..."
}
HTTP/1.1 301 Moved Permanently
Location: https://graf01.lab/dashboards
HTTP/1.1 302 Found
Server: nginx/1.28.3 (Ubuntu)
Location: /login

--cacert tells curl to trust your own certificate, so the first call checks the full chain and name. Port 80 redirects to HTTPS with the path kept, and the root redirects to /login because you aren’t logged in. The “commit” line shows your build’s real Git hash, and on 24.04 the Server line reads nginx/1.24.0 (Ubuntu).

✅ Checkpoint: /api/health answers over HTTPS with the cacert option, port 80 redirects to https://graf01.lab/, and / redirects to /login.

7Trust the certificate on your laptop and log in

Copy the certificate to your laptop with scp student@192.168.56.70:/etc/ssl/graf01/graf01.crt . and import it: on Windows double-click it and install into “Trusted Root Certification Authorities”, on macOS add it to the System keychain in Keychain Access and set it to Always Trust, and in Firefox use Settings > Privacy & Security > Certificates > Import. Then open https://graf01.lab/ and log in.

If you’d rather not import it, the browser shows a warning page and you can continue with “Advanced”, which is fine for a lab but trains bad habits, so prefer the import. Open any dashboard (or Explore with TestData), then in the browser developer tools Network tab filter on “ws”: you should see a request to wss://graf01.lab/api/live/ws with status 101.

✅ Checkpoint: https://graf01.lab/ loads Grafana with a padlock, and /api/live/ws shows status 101 Switching Protocols.

8Prove that port 3000 is closed

Run this on your laptop:

curl -s -m 5 http://192.168.56.70:3000/api/health || echo "blocked"

You should see:

blocked

The request times out after 5 seconds because nothing outside graf01 can reach Grafana’s port any more. If you see the health JSON instead, check http_addr and that ufw is active.

✅ Checkpoint: Port 3000 is unreachable from the laptop and Grafana still works through https://graf01.lab/.

9Check the logs and save a snapshot

Close the Grafana browser tab first, because Nginx writes the log line for a WebSocket only when that connection ends.

Run this on graf01:

sudo grep -oE '"(GET|POST) /api/(live/ws|ds/query)[^ ]* HTTP/1.1" [0-9]+' /var/log/nginx/access.log | sed 's/?[^ ]*//' | sort | uniq -c
sudo grep -c '" 403 ' /var/log/nginx/access.log

You should see (your counts will differ):

      1 "GET /api/live/ws HTTP/1.1" 101
      6 "POST /api/ds/query HTTP/1.1" 200
0

The first command pulls the request and status out of each matching access log line, drops the query string and counts them. You get one WebSocket upgrade (101) per browser tab you opened and one 200 for each query you ran. Zero 403 lines means no request was refused, so the Host header is right.

Shut graf01 down and take a snapshot called https.

✅ Checkpoint: Nginx logs 101 for /api/live/ws and 200 for queries, and graf01 has a snapshot called https.